<strong>Health</strong> Law Bulletin No. 82 September 2005patient’s permission or an order issued by ajudge or the Industrial Commission.The department must review and comply with allof these laws. While the first two laws identifiedabove would likely allow disclosure of in<strong>for</strong>mation inresponse <strong>to</strong> a subpoena (as long as HIPAA’sconditions are satisfied), the third law would not.There<strong>for</strong>e, the department must await a court orderbe<strong>for</strong>e disclosing the in<strong>for</strong>mation requested in thesubpoena.This example highlights an important and highlyrestrictive state law—the physician-patient privilege.It is important <strong>for</strong> health departments <strong>to</strong> rememberthat in<strong>for</strong>mation subject <strong>to</strong> this privilege (or otherprivileges such as the nurse privilege 44 ) must not bedisclosed in response <strong>to</strong> a subpoena. Either a cour<strong>to</strong>rder or the patient’s permission is required by statelaw.Once the health department has evaluated theconfidentiality laws that apply <strong>to</strong> the requestedrecords, it must decide how <strong>to</strong> respond. The responsewill depend on whether the subpoena is accompaniedby an authorization from the patient.Question 28. How should I respond if thesubpoena <strong>for</strong> confidential medical recordsis accompanied by an authorization <strong>for</strong>msigned by the patient?Occasionally an at<strong>to</strong>rney will send anauthorization <strong>for</strong>m with a subpoena. In such cases, ifthe accompanying authorization <strong>for</strong>m is valid (seediscussion below), you should disclose the records asdirected in the subpoena or authorization <strong>for</strong>m. Forexample, if an assistant district at<strong>to</strong>rney is gatheringevidence <strong>for</strong> a domestic violence prosecution and isseeking copies of the victim’s medical records fromthe health department, the at<strong>to</strong>rney may be able <strong>to</strong>obtain the victim’s authorization <strong>to</strong> obtain copies ofthe records. 45When presented with a subpoena and anauthorization <strong>for</strong>m (or an authorization <strong>for</strong>m byitself), a health department should review theauthorization <strong>for</strong>m <strong>to</strong> determine whether it complies44. G.S. 8-53.13.45. Note that, unless a specific law providesotherwise, district at<strong>to</strong>rneys and other lawyers with publicagencies are subject <strong>to</strong> the same limitations on theirauthority <strong>to</strong> obtain in<strong>for</strong>mation as private at<strong>to</strong>rneys. Theirstatus as public officials or public servants does notestablish additional rights of access <strong>to</strong> in<strong>for</strong>mation.with all applicable legal requirements. One of themost specific laws in this regard is the HIPAAPrivacy Rule. For medical in<strong>for</strong>mation subject <strong>to</strong> thatlaw, an authorization <strong>for</strong>m must include thefollowing core elements <strong>to</strong> be valid:• A specific description of the in<strong>for</strong>mation <strong>to</strong>be disclosed• The name of the person or organizationauthorized <strong>to</strong> disclose the in<strong>for</strong>mation• The name of the person or organizationauthorized <strong>to</strong> receive the in<strong>for</strong>mation• A description of the purpose of thedisclosure 46• An expiration date or event 47• The signature of the patient or the patient’srepresentative 48• A statement explaining the patient’s right <strong>to</strong>revoke the authorization• A statement explaining the department’sability or inability <strong>to</strong> place conditions upon apatient’s decision <strong>to</strong> sign the authorization 49In addition <strong>to</strong> specifying these core elements, theHIPAA Privacy Rule imposes additionalrequirements and restrictions on authorization<strong>for</strong>ms. 50 Because of these strict requirements, healthdepartments should either insist upon using their ownHIPAA-compliant authorization <strong>for</strong>ms or carefullyreview authorization <strong>for</strong>ms from other sources <strong>to</strong>ensure that they meet all of HIPAA’s requirements.If the <strong>for</strong>m complies with all applicable laws, thehealth department should disclose the records <strong>to</strong> theperson specified in the authorization. For example,the authorization <strong>for</strong>m may request that copies of therecords be sent directly <strong>to</strong> the requesting at<strong>to</strong>rney.46. If the patient initiates the authorization and doesnot wish <strong>to</strong> describe the purpose of the disclosure, the <strong>for</strong>mmay state “at the request of the individual.” 45 C.F.R.164.508(c)(1)(iv).47. The expiration date or event must relate either <strong>to</strong>the individual or <strong>to</strong> the purpose of the disclosure. 45 C.F.R.164.508(c)(1)(v).48. If it is signed by a patient’s representative, the<strong>for</strong>m must also describe the representative’s authority <strong>to</strong> act<strong>for</strong> the individual (such as “parent,” “guardian,” or “powerof at<strong>to</strong>rney”). 45 C.F.R. 164.508(c)(1)(vi).49. The HIPAA Privacy Rule limits a provider’sability <strong>to</strong> condition treatment, payment, or enrollment oreligibility <strong>for</strong> benefits on the authorization. 45 C.F.R.164.508(b)(4).50. 45 C.F.R. 164.508(b).14
September 2005 <strong>Health</strong> Law Bulletin No. 82If an at<strong>to</strong>rney sends the health department a validauthorization <strong>for</strong>m but no subpoena, the departmentmay still disclose the records. A subpoena istechnically not necessary. The authorization <strong>for</strong>malone provides sufficient authority <strong>for</strong> the healthdepartment <strong>to</strong> disclose confidential in<strong>for</strong>mation <strong>to</strong> anat<strong>to</strong>rney or the court.Question 29. How should I respond if thesubpoena <strong>for</strong> confidential medical recordsis not accompanied by an authorization<strong>for</strong>m?If the subpoena requests in<strong>for</strong>mation that issubject <strong>to</strong> a confidentiality law that requires a cour<strong>to</strong>rder or patient permission, such as the physicianpatientprivilege, the health department should notau<strong>to</strong>matically disclose the in<strong>for</strong>mation. It must,however, respond <strong>to</strong> the subpoena. As a first step, thedepartment (or the department’s at<strong>to</strong>rney) maycontact the at<strong>to</strong>rney requesting the records andexplain that they are confidential. The requestingat<strong>to</strong>rney may choose <strong>to</strong> withdraw the subpoena ormay take the necessary steps <strong>to</strong> authorize disclosure(such as obtaining a court order or permission fromthe person who is the subject of the records). If thatdoes not happen, the health department should eithercontest the subpoena (discussed in Question 23,above) or appear at the proceeding with the recordsand await further direction from the court (discussedbelow). You may follow either approach whensubpoenaed <strong>to</strong> a proceeding in court. 5151. Revised Rule 45(c)(5) establishes a time limit <strong>for</strong>moving <strong>to</strong> quash or modify a subpoena that is served morethan ten days be<strong>for</strong>e the proceeding—namely, such amotion must be made within ten days of service. (The rulewas not materially revised <strong>for</strong> subpoenas served less thanten days be<strong>for</strong>e the proceeding—the responding party maystill raise challenges at the time of the proceeding.) In ourview, if a subpoena <strong>for</strong> confidential records is served morethan ten days be<strong>for</strong>e a court proceeding, a cus<strong>to</strong>dian maybut is not required <strong>to</strong> make a motion <strong>to</strong> quash. A cus<strong>to</strong>dianstill may bring the records <strong>to</strong> the proceeding, as directed bythe subpoena, and await further direction from the courtbe<strong>for</strong>e disclosing them. We believe this <strong>to</strong> be so <strong>for</strong> tworeasons. First, a cus<strong>to</strong>dian who produces records in thismanner is not seeking <strong>to</strong> quash or modify the subpoena.Nor is the cus<strong>to</strong>dian disregarding the subpoena. Rather, thecus<strong>to</strong>dian is seeking <strong>to</strong> comply with the subpoena’scommands without violating confidentiality laws. Second,confidentiality laws are not personal rights of the cus<strong>to</strong>dian,which the cus<strong>to</strong>dian may waive by not making a motion <strong>to</strong>If you appear at the proceeding with therequested records, you should not immediately turnthem over <strong>to</strong> the subpoenaing at<strong>to</strong>rney or the court.Because the records are confidential, the healthdepartment has a duty <strong>to</strong> take affirmative steps <strong>to</strong>ensure that the records are only disclosed aspermitted by law. The exact way <strong>to</strong> handle eachsituation will depend on the confidentiality laws thatapply, but the approach will be similar in mostinstances. For example, a health department mayreceive a subpoena directing the records cus<strong>to</strong>dian <strong>to</strong>appear in court with certain patient records that areprotected by the physician-patient privilege. Thephysician-patient privilege law allows a district orsuperior court judge <strong>to</strong> order disclosure of records ifhe or she finds that disclosure is “necessary <strong>to</strong> theproper administration of justice.” 52 In this situation,the cus<strong>to</strong>dian may appear in court with the requestedrecords on the date and at the time specified in thesubpoena. The cus<strong>to</strong>dian should not release therecords ahead of time <strong>to</strong> the party who issued thesubpoena.Once the proceeding begins and the cus<strong>to</strong>dian isasked <strong>for</strong> the records, the cus<strong>to</strong>dian should explain <strong>to</strong>the judge that the records are protected by thephysician-patient privilege and that a court order isrequired <strong>to</strong> disclose them. If the records containsensitive in<strong>for</strong>mation, the cus<strong>to</strong>dian (or an at<strong>to</strong>rneyrepresenting the cus<strong>to</strong>dian) may request that thejudge review the records in camera—that is, inprivate, in his or her chambers—be<strong>for</strong>e decidingwhether <strong>to</strong> release them. 53 If the records are notquash. Rather, they establish the conditions under whichdisclosure may be ordered by a court (or would bepermissible without a court order, as when the subject ofthe records properly consents <strong>to</strong> disclosure). In contrast,other grounds <strong>for</strong> withholding documents in response <strong>to</strong> asubpoena, such as undue burden, are personal <strong>to</strong> the recordscus<strong>to</strong>dian and may be waived if not timely asserted.52. G.S. 8-53.53. See, e.g., Pennsylvania v. Ritchie, 480 U.S. 39(1987) (discussing procedure); Zaal v. State, 602 A.2d1247 (Md. 1992) (court may conduct review of records inpresence of counsel or permit review by counsel alone, asofficer of court, subject <strong>to</strong> restrictions protectingconfidentiality); see also Rios v. Read, 73 F.R.D. 589(E.D.N.Y. 1977) (judge may require in disclosure order thatparties who receive records not reveal their contents except<strong>to</strong> those connected with litigation). In the context ofin<strong>for</strong>mation related <strong>to</strong> communicable diseases, stateconfidentiality law authorizes in camera review if it isrequested by the subject of the in<strong>for</strong>mation. See G.S. 130A-143(6).15